CVE-2026-74756: Apache James: WebAdmin exposed without authentication on official Docker default

Published Nov 6, 2026

Updated

Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache James to a version that resolves this vulnerability.
Fixed in 3.9.1

Event History

Nov 6, 2026

CVE Published

via MITRE·11:43 AM

Data Sourced

via MITRE·11:43 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are most exposed?

Docker Compose deployments using project-shipped configurations that expose the WebAdmin REST API publicly without proper authentication are affected. The issue is specifically tied to the official Docker default configuration.

What changes in version 3.9.1?

Version 3.9.1 onward sets a random credential by default for unprotected WebAdmin endpoints. This is intended to prevent unauthenticated public exposure while retaining convenience.

What can be done before upgrading?

Ensure the WebAdmin REST API is not publicly exposed without proper authentication. Restrict access to the endpoint and configure authentication for any WebAdmin service that must remain reachable.

CVE-2026-74756: Apache James: WebAdmin exposed without authentication on official Docker default

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed?

What changes in version 3.9.1?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed?

What changes in version 3.9.1?

What can be done before upgrading?